Marc Schier
0374e19121
# Description _Describe the changes here to communicate to the maintainers why they should accept this pull request. By default - this will become the Commit message after merging and thus define history._ Add provider-backed MachineTool, bundled WMTP, GMS and CranesHoists companions using the existing Machinery/MachineVision fluent, DI and typed-client approach. **The PR is open/non-draft by user choice. Current head `ecc4a7d6ca3e8004cf28ab54da605da302d026bf` is mergeable and has 108 successful checks, six intentionally skipped checks, zero failures and zero pending checks. All five primary workflows completed successfully at that exact head.** | Family | Released specification/model | Packaging | | --- | --- | --- | | MachineTool | OPC 40501-1, 1.02.0 | Model, Server, Client and MCP; normal root versions | | WMTP | OPC 40505, 1.0.0 | Bundled in MachineTool; distinct CLR/wire namespace and independent WMTP-only hosting | | GMS | OPC 40210 reference 1.0.1, normative model 1.0.0 | Model, Server, Client and MCP; normal root versions | | CranesHoists | OPC 40020-1, 1.00 | Model, Server, Client and MCP; all four plus Debug variants forced preview | There are **12 new packable projects**. No separate WMTP package/profile/guide, root version bump, tag, release or package publication is included. Mandatory instance structure is the default; selected optional features require explicit providers. The implementation reuses Machinery results/jobs/files/ProcessValues and Robotics topology, including retained MachineTool Production, defined GMS jobs/parts, modern ISA95/Machinery jobs, shared-owner hosting and isolated instances alongside MachineVision. Runtime and integration fixes preserve raw quality/timestamps, coherent acquisition, namespace ownership, accepted-configuration state, borrowed-resource lifetime, session/node/file cleanup, terminal-value publication, event propagation and endpoint-aware capability publication. Firmware/licence transfer means provider acceptance, not installation/activation. Cancellation does not silently abort another caller's operation. The later upstream MCP expansion is integrated without losing either family set or its default-off privileged/live execution policy. ### Conformance and scope Canonical model inputs are pinned to UA-Nodeset revision `96a08945425d0295edb3607d2a38f6841ef44046`. **GMS upstream exception:** [Annex A.1](https://reference.opcfoundation.org/specs/OPC-40210/annex-a) makes the released NodeSet normative, but §12.3.2.7 requires undefined `GMS_ProductionStatisticsType`. Inherited statistics and defined jobs/parts are implemented without inventing a standard type/NodeId; the complete GMS Production facet is withheld. The requirement ledger records **102 positively evidenced CU rows, 96 directly negative-tested rows and six explicit negative-evidence limitations**. All 648 test-class/name/TRX links were independently resolved to passing cases. The six limitations concern Stacklight, retained legacy PowerOnDuration, Machinery PowerOnDuration, WorkingUnit, Obligation and MaintenanceMode. They are not claims that every invalid-input or hardware-control behavior was tested. The undefined GMS requirement is outside the 102 defined CUs. No external certification claim is made. Retained baseline complete-assembly line coverage, with generated code retained and no source exclusions: | Family | Model | Server | Client | | --- | ---: | ---: | ---: | | MachineTool/WMTP | 83.80% | 91.98% | 84.74% | | GMS | 95.51% | 90.63% | 88.38% | | CranesHoists | 92.76% | 94.45% | 92.24% | These nine measurements predate the later focused review fixes and merges; they are not relabelled as new `ecc4a7d6c` percentages. The current head's separate CI code-coverage check succeeded. No new exclusions or threshold relaxations were introduced. ## Related Issues - Fixes [#4764](https://github.com/OPCFoundation/UA-.NETStandard/issues/4764), the implementation/design and acceptance tracker. ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [x] I have addressed **all** PR feedback received.
MachineTool and wireless-peripheral samples
These applications use the released typed MachineTool/WMTP runtime and clients. Their providers are explicitly simulated: no CNC instructions, Bluetooth pairing, radio driver, firmware installation or licence activation is performed.
Build both applications before starting the bounded server:
dotnet build samples\MachineTool\MachineToolServer\MachineToolServer.csproj -f net10.0
dotnet build samples\MachineTool\MachineToolClient\MachineToolClient.csproj -f net10.0
Run a secure, isolated workcell
In one terminal:
dotnet run --no-build --project samples\MachineTool\MachineToolServer -f net10.0 -- --mode mixed --advanced --instances 2 --seconds 120 --demo-trust --allow-commands --simulate-job Machine1
After its actual READY message, in another terminal:
dotnet run --no-build --project samples\MachineTool\MachineToolClient -f net10.0 -- --demo-trust
Default endpoint: opc.tcp://127.0.0.1:62558/MachineToolServer.
--port 0 chooses an available port; pass the reported URL to the client's
--endpoint. The server always binds loopback. --demo-trust is an explicit
local-only certificate exception; SignAndEncrypt/Basic256Sha256 remain
required. Without it, administer separate client/server trust stores with
--pki. Never deploy demo trust as production authorization.
--mode machine, wmtp and mixed select independent model closures.
Mandatory-only is the default; --advanced selects production/jobs/files and
all eight wireless measurement kinds, metadata and independent work/service
records. --instances 1..4 creates independent providers/stores for each
selected family.
The client discovers native identities, reads raw values/capabilities and complete bounded records, then makes one bounded observation. It preserves UA quality and acquisition time. Reports copy records rather than consuming them. A WMTP-only endpoint never fabricates a MachineTool.
Explicit commands
Every client mutation requires --target and --consent. The server separately
requires --advanced --demo-trust --allow-commands; --refuse-commands provides
a deterministic refusal scenario.
# Read the non-executable WorkMasters file and submit the declared ISA95 order.
dotnet run --no-build --project samples\MachineTool\MachineToolClient -f net10.0 -- --demo-trust --target Machine1 --read-files --command job-store-start --consent
# Accept a UInt32 trigger setting, then explicitly prove a second request is refused.
dotnet run --no-build --project samples\MachineTool\MachineToolClient -f net10.0 -- --demo-trust --target Peripheral1 --command configure --sensor Temperature --trigger-ms 2000 --consent --prove-refusal
# Transfer generated, nonsecret demonstration bytes. Acceptance is not installation.
dotnet run --no-build --project samples\MachineTool\MachineToolClient -f net10.0 -- --demo-trust --target Peripheral1 --command firmware --transfer-bytes 32 --consent
Use --help for calibration, explicit UTC time, selected record deletion,
licence transfer and explicit abort. Local timeout/cancellation never sends
AbortOperation or retries an uncertain write.
Each peripheral accepts at most one simulated configuration, calibration,
time setting and transfer of each kind; later requests are refused. A refused
configuration retains the previously accepted trigger/delta.
The separately selected server --simulate-job Machine1 supplies explicit
execution/part observations after StoreAndStart. Job acceptance alone never
means a machine executed anything.
Lifetimes and bounds
Server windows are 1-600 seconds. Client work has a 90-second deadline;
observation is 0-20 seconds and 1-100 notifications. Discovery, sensors, files,
record reports and transfer bytes have explicit ceilings. Oversize data fails,
not silently truncated success. --freeze-measurements demonstrates real stale
quality on advanced wireless observations.
--cancel-after-ms exercises bounded cancellation. Exit codes are 0 completed,
1 error/refusal, and 2 cancelled. Natural server shutdown joins acquisition,
drains runtimes, releases providers and deletes only its generated temporary
read-only program folders. PKI remains available for administration.
Clients close call-owned subscriptions/files and their managed session.
Frameworks and NativeAOT
Both projects support net48, net8.0, net9.0 and net10.0. NativeAOT is selected only on the application projects for net10.0:
dotnet publish samples\MachineTool\MachineToolServer -c Release -f net10.0 -r win-x64 --self-contained true
dotnet publish samples\MachineTool\MachineToolClient -c Release -f net10.0 -r win-x64 --self-contained true
Run the published executables with the same CLI arguments; publishing alone does not prove native behavior. See the developer guide for provider contracts and CompanionSuite for all families on one DI/Machinery owner.